Add comments explaining what entrypoint is supposed to do#7792

stuartpb

This way the DOCKER_USER variable won't accidentally retain sudoer permissions for any user not named coder (almost certainly a security hole).

code-asher

How would this be reproduced? We create the coder user as part of the image so it will always be the right user to remove:

code-server/ci/release-image/Dockerfile

Lines 37 to 38 in 53d981a

    
           && adduser --gecos '' --disabled-password coder \ 
        
           && echo "coder ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers.d/nopasswd

If the user is not coder somehow, then these previous lines trying to rename it will fail anyway.

code-server/ci/release-image/entrypoint.sh

Lines 14 to 15 in 53d981a

    
           sudo usermod --login "$DOCKER_USER" coder 
        
           sudo groupmod -n "$DOCKER_USER" coder

stuartpb

We create the coder user as part of the image so it will always be the right user to remove

Okay, so now imagine the crazy hypothetical scenario where literally any part of that very specific scaffolding for this specific fork of the codebase provided by the outside environment changes, for any reason, like if, I dunno, the name of the company changed and you missed one or two extant references to it.

stuartpb

Or rather, sorry, I guess I just don't understand how any of these variables are expected to work because there are zero usable comments here. The idea is that the line we're deleting isn't supposed to be deleting the user named by DOCKER_USER? How am I supposed to understand what this code's supposed to be doing?

stuartpb

Here, I've updated the PR, here's a version where you can tell what cases would and wouldn't have bugs because the code actually describes what it's trying to do.

code-asher

Thanks!

Okay, so now imagine the crazy hypothetical scenario

Yeah it would probably make sense for us to use the USER env var instead of hardcoding coder in case we ever change the user in the docker image and miss updating the entrypoint with the new name.

This will now run when DOCKER_USER is blank where before it would not, should probably be something like

if [ "${DOCKER_USER-}" ] && [ "$DOCKER_USER" != coder ]; then

Although, since we check if the user already exists below, it is probably not necessary to add this guard, but I suppose no harm in it either.

stuartpb requested a review from a team as a code owner May 11, 2026 04:53

Add comments explaining what entrypoint is supposed to do …

0deb740

Also fixes the case where DOCKER_USER=coder

stuartpb force-pushed the patch-1 branch from dde239d to 0deb740 Compare May 18, 2026 22:50

stuartpb changed the title Fix sed command to remove last line in sudoers file Add comments explaining what entrypoint is supposed to do May 18, 2026

code-asher reviewed May 20, 2026

View reviewed changes

code-asher force-pushed the main branch 3 times, most recently from ffbdec0 to cd15862 Compare May 20, 2026 22:09

code-asher force-pushed the main branch from 3a3ffdd to 1ccd4f0 Compare June 16, 2026 00:42

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add comments explaining what entrypoint is supposed to do#7792